cbcvebase.
CVE-2009-2898
published 2009-10-13

CVE-2009-2898: Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1…

PriorityP416low3.5CVSS 2.0
AVNACMAuSCNIPAN
EXPLOIT
EPSS
1.83%
76.2th percentile
Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field. NOTE: some of these details are obtained from third party information.

Affected

18 ranges
VendorProductVersion rangeFixed in
springsourceapplication_management_suite——
springsourcehyperic_hq——
springsourcehyperic_hq——
springsourcehyperic_hq——
springsourcehyperic_hq——
springsourcehyperic_hq——
springsourcehyperic_hq——
springsourcehyperic_hq——
springsourcehyperic_hq——
springsourcehyperic_hq——
springsourcehyperic_hq——
springsourcehyperic_hq——
springsourcehyperic_hq——
springsourcehyperic_hq——
springsourcehyperic_hq——
springsourcehyperic_hq——
springsourcehyperic_hq——
springsourcetc_server——
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.